Description of problem:
Puppetclass.search_for shows up in puppetclasses_controller and its respective method of the API. It uses scoped_search to look for all puppetclasses that a host contains. Unfortunately, in the event of a lookup of a host that either belongs to no hostgroup or a host that doesn't exist, this will return all puppetclasses.
This fix checks for this conditions and avoids returning all puppetclasses.
curl -v -k -H d"Content-Type:application/json" https://foreman/api/hosts/nonexistenthost/puppetclasses returns
Puppetclass.all without this fix,
after this fix it returns {} (no puppet classes, which is correct)
Additional info:
Fixed upstream in ce897ade5ae2ecc3f9c3bd62dc6b92da1c908097.